XSL Script Processing

On Windows, adversaries may embed scripts in XSL stylesheets and invoke them through an XSL processor to obscure code execution or potentially bypass application control. Documented variants use msxsl.exe with XML/XSL inputs or Windows Management Instrumentation's WMIC /FORMAT switch with a local or remote stylesheet. The embedded script can use JScript or VBScript; application-control bypass and successful script execution are not guaranteed.